We are seeing abnormal outbound data exfiltration on AWS, what specific IAM and VPC flow log queries should I run right now to identify the compromised S3 buckets?
Download run
Fan-out diagram
The searches the AI actually ran for this prompt.
SEED QUERY
We are seeing abnormal outbound data exfiltration on AWS, what specific IAM and VPC flow log queries should I run right now to identify the compromised S3 buckets?
2 real searches · 1 real-search pass
Badge and edge weight = share of passes that produced the query. Hover a query for its intent and routing format.
Query classes
Google's semantic query class for every sub-query: what kind of answer each search is after, simulated vs real.
Classifying 2 queries…
Searches and sources
ChatGPT2 real searches · gpt-6
AWS CloudTrail S3 data events Athena query examples eventName GetObject ListBucket official documentation Google ↗
AWS VPC Flow Logs Athena query bytes srcaddr dstaddr action official AWS documentation Google ↗
- Identifying Amazon S3 requests using CloudTrail · docs.aws.amazon.com
- Understanding CloudTrail events · docs.aws.amazon.com
- Query flow logs using Amazon Athena · docs.aws.amazon.com
- Create a table for Amazon VPC flow logs and query it · docs.aws.amazon.com
- Use CloudWatch Logs Insights to analyze custom VPC Flow Logs · repost.aws
Queries
2 queries · click a column to sort
| Query / type | Search | Intent | Query class | Routing format | Cluster | Freq ↓ | Weight |
|---|---|---|---|---|---|---|---|
AWS CloudTrail S3 data events Athena query examples eventName GetObject ListBucket official documentation OBSERVED | Google ↗ AI Mode ↗ | — | — | — | — | 1x of 1 | |
AWS VPC Flow Logs Athena query bytes srcaddr dstaddr action official AWS documentation OBSERVED | Google ↗ AI Mode ↗ | — | — | — | — | 1x of 1 |